Ukuxhumana okusha kuphuma ku-VPN entsha, ukuhamba kwakadala kushiywa

Ukukhipha okuhleliwe kuhambisa kuphela ukuhamba okungahlukanisiwe. Qhathanisa nalokho noshintsho lomzila, futhi ubone izimpawu, amathebula nesimo se-conntrack okukugcinayo.

Iziphuma ezimbili ze-VPN ezinempilo, ukulayisha okude okusebenzayo kakade, kanye nemfuneko yokuthi ukuxhumana okulandelayo kusebenzise enye indlela engaphansi. Kunezindlela ezimbili zokukufeza lokho, futhi munye kuphela oziphephile esangweni eliphilayo. Ukushintsha umzila wokuzenzakalela kuhambisa wonke amaphakethe, kuhlanganise nalawo awokulayisha. Ukukhipha okuhleliwe kushintsha ukukhetha kokuxhumana okusha futhi kushiye ukuhamba okulandelelwe emzileni okuqale kuwo.

Izindlela ezimbili zokushintsha isiphuma

Ukushintsha umzila kuwumyalo owodwa futhi kungabuyiselwa emuva ngemizuzwana, yingakho kusetshenziswa ngesikhathi sezigameko. Futhi akukhethi: amaphakethe okulayisha okukhona aphuma ngokuphuthuma ngaphesheya komunye umhubhe, nekheli lomthombo lomphakathi elihlukile nesimo sokuhumusha esihlukile.

Uma ukuphela okude kulandelela ukuhamba ngekheli lomthombo, ukulayisha kungase kuyeke ukubonakala. Ukukhipha kugwema lokho ngokuthatha isinqumo kanye ngokuxhumana ngakunye nokukugcina, ngakho ukulayisha kwakadala kugcina isiphuma sako kuze kuqede. Yilokho okungukubaluleka konke kwalomsebenzi: ukuphela okude akuboni lushintsho okumele lukuchaze. Kuqhubeka nokuthola amaphakethe ahambisana nokuxhumana elikwaziyo kakade.

Intengo ubunkimbinkimbi: amathebula amabili omzila, isihlukanisi esisebenza ku-hook efanele, kanye nezimpawu okumele zixhumaniswe nakho konke okunye emshinini okuzisebenzisayo.

Nika isiphuma ngasinye ithebula laso

Bekela ithebula lomzila isiphuma ngasinye kanye namanani ezimpawu noma amabhithi ahlukile kokukhetha okubili. Ithebula ngalinye lidinga imizila efanele indima yalo, hhayi igama kuphela, futhi lidinga umphumela wokwehluleka ngamabomu wesimo esingekho. Ithebula elingenalutho eliwela buthule kuthebula eliyinhloko — yileyo ndlela okuhamba ngayo kuphuma ngesiphuma okungakhethwanga muntu.

ip rule add fwmark 0x10/0x10 table 101
ip rule add fwmark 0x20/0x20 table 102
ip route add default via 192.0.2.1 dev wg-a table 101
ip route add default via 198.51.100.1 dev wg-b table 102

Engeza umzila we-blackhole ekupheleni kwethebula ngalinye ukuze ukusesha okungatholi ukufana kuhluleke ngomsindo esikhundleni sokubalekela okuzenzakalelayo ongakukhethanga.

Khetha kanye, kuphakethe lokuqala

Hlukanisa ngemuva kokuthi ukulandelela ukuxhumana kukhona nangaphambi kokusesha komzila okubalulekile. Kokuxhumana okusha kwase-LAN okungahlukanisiwe, khetha isiphuma futhi ukugcine esimweni sokuxhumana. Emaphaketheni alandelayo, buyisela inani eligciniwe kuphawu lwephakethe olufundwa ukuhlelwa komzila ngomgomo.

Ingxenye ebucayi ukuthi kusho ukuthini okusha. I-conntrack isengabika i-NEW kumaphakethe okuqala nokudluliswa kabusha ngaphambi kokubona impendulo, ngakho isihlukanisi esincike kuleso simo kuphela singabhala phezu kokukhetha okwenzile kakade. Ngaphambi kokwaba okukodwa, qinisekisa ukuthi akukho siphuma esigciniwe salokho kuxhumana.

I-nftables igcina izimpawu zephakethe nokuxhumana zihlukene, futhi umhlahlandlela we-metainformation ubhala ukukopishwa okucacile phakathi kwazo. Uphawu lokuxhumana aluphenduki lwaba uphawu lwephakethe umthetho wakho ohambisana nalo ngokwalo, futhi yisona sizathu esivame kakhulu sokuthi isihlukanisi esibhalwe ngokucophelela singabi nawo umphumela.

Khawulela ukubuyisela engqondweni nasekuhambeni okuhloswe. Ukusebenzisa uphawu lwesiphuma se-inthanethi kumaphakethe abuyayo kungathumela izimpendulo ngasemva kwesiphuma esikhundleni se-LAN, futhi uphawu ukuxhumana kwendlela eyodwa okubonakala njengenkinga yodonga lomlilo. Funda umzila wempendulo ngaphambi kokuthinta umthetho wodonga lomlilo, ngoba iphakethe lihlelwa emzileni, hhayi nje ukubuyela kumthumeli.

Izigaba ezine zokukhipha

  1. Lungiselela i-B ngaphandle kokuthinta i-A: ukuhlela umzila, ukudlulisela, ukugunyaza, i-NAT kanye nomzila wokubuya. Faka ithebula laso nomgomo wokukhetha waso ngomnikazi wokumisa okhona wesango.

  2. Shintsha isihlukanisi ukuze ukuxhumana okusha okungahlukanisiwe kukhethe i-B, kuyilapho ukukhetha okugciniwe kugcinwa. Ukuthengiselana kwe-nftables okuyi-athomu kugwema iwindi okumele kususwe kulo isimo sakadala.

  3. Shiya i-A ivuliwe ukuze ukuhamba kwayo kuqede. Isixhumi sayo, ithebula, isiphuma esikude kanye namamephu e-NAT kuseyingxenye yalokho kuhamba, futhi ukuhlela umthetho we-NAT akukwakhi kabusha ukuxhumana okukhona kakade.

  4. Khipha i-A emsebenzini lapho isimo sokukhipha sifeziwe, kuhlolwe ngesimo sokuxhumana nokuziphatha kohlelo esikhundleni sesikhawu esisodwa esithule.

Lokho ukukhipha akukwazi ukukuthembisa

Isicelo sesiphequluli akulona ukuxhumana okusha kokuthutha; ukuhlanganisa kuqhubeka nokuthumela izicelo ngakolunye oludala. Ngakolunye uhlangothi, ukuhamba kwe-UDP kungaguga kuphume ku-conntrack futhi iphakethe lakamuva lihlukaniswe kabusha. Ukukhipha kulandela ukuhamba okulandelelwe, hhayi umqondo wohlelo womhlangano.

Uma i-A yehluleka ngaphambi kokuba ukuhamba kwayo kuqede, uphawu olugciniwe alubasindisi. Baphinda baxhumane nge-B, noma abaphindi baxhumane nhlobo. Ukukhipha okuhleliwe kuthenga ukuqhubeka ngesikhathi umzila wangempela unempilo; akukona ukukopishwa kwesimo phakathi kwezigaba ezizimele.

Qinisekisa izingxenye zombili

Qala ukuxhumana okuvunyelwe kwesikhathi eside ngaphambi koshintsho nokusha ngempela ngemuva kwako. Qinisekisa ukuthi yimuphi umhubhe okusetshenziswa yilowo nalowo nokuthi ukuphela okude kubona likhulu leliphi ikheli lomthombo lomphakathi, bese uhlola ukuthi ukuhamba okubuyayo kuyabuya.

Ungasuli ithebula le-conntrack ukuze ukukhetha okusha kubonakale. Lokho kubhubhisa isimo okumele ukukhipha kusigcine, futhi kuphendula ukufuduka okulawulwayo kube ukuphazamiseka okunokuhlolwa okubonakala kuhlanzekile.

Izihloko ezihlobene